6ea2110bf54fb18e90867856906d14ec3525e3a5bf293b87ab9ac3554cd34dd2

Analysis

max time kernel
136s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02d1e302c165e90b6795767d52360f80_JaffaCakes118.html
Size

213KB
MD5

02d1e302c165e90b6795767d52360f80
SHA1

596ace61eed67163fff88a67d547173de6ad3e67
SHA256

6ea2110bf54fb18e90867856906d14ec3525e3a5bf293b87ab9ac3554cd34dd2
SHA512

720b5a24d58d8caf0f88b202f4653755e8cff3e91f84f3a9983d10cae0233a0624251eaf523f0ccbfe925766ce4164af0efa282de778ede2805effee3ccd4343
SSDEEP

3072:Sn+JuJUiz2syfkMY+BES09JXAnyrZalI+YQ:SnjURsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{47294271-046F-11EF-93CC-729E5AF85804} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420368013"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1632	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1632	iexplore.exe
1632	iexplore.exe
1912	IEXPLORE.EXE
1912	IEXPLORE.EXE
1912	IEXPLORE.EXE
1912	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1912	1632	iexplore.exe	28
PID 1632 wrote to memory of 1912	1632	iexplore.exe	28
PID 1632 wrote to memory of 1912	1632	iexplore.exe	28
PID 1632 wrote to memory of 1912	1632	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\02d1e302c165e90b6795767d52360f80_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1632 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e3b1d667f13c131a00e2fee27103fc3

SHA1
a136723ce1d6d1abf1da7e553482717a34b42048

SHA256
30a4b579814414a2a54e783925598af43bb4bda0964e82f6baab9f2d9a3def13

SHA512
132a67ac7e0568b1136e57bbcb2ed4f5af00954a2164bab0bf25b4ace28fd6ad19cfacf52ec0706048527ac0ba19b4bcfd758529c6ab46ba3b2f156efee4f7ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1023a860845b789773610e1e7351667b

SHA1
25f01d106288daa588fb62951e9d3a2a47c8bc7a

SHA256
6ed705ca74700ff08d374ed733e7289756ce6369a55e6f1f5aa30d3888288e77

SHA512
79be281484f210b208dd06245876c0c66ff337ec322bb8625cc7335e6926d3d6dacd38aba5ca9ffff4418fb3091a28e0e04532224779b1712bddb9497087e86b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb92884ccf7da37aa208a92b38d67c85

SHA1
3ec34f914529ade37a3609af37eb5f5135007a53

SHA256
4690a8e922bf9f5f376424bd3032039c91a7109289b138e917ee5b7e251cf30b

SHA512
e1d3b38ddf106210bfa887fe12ff0b2917bfdb5e9660427a231fd697fea539b013aafb1230f1deb4b484e06b34d47aa9835c716cec4826e24923ffb0cc80eac5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a4414edb6e6401d931452cc153f7676

SHA1
32f0c4d33f4fdefb0d58d43c443ac00a00d630ae

SHA256
8e1624b1b973c23747f14f337e5ea32b13eaf1b368ad12d34d234d7193f1f7c9

SHA512
688f4fc5f1f25e5d0cdcf7d8c70d589e9239906c6c1520a1739dab173059185bc0332d66f59b00e62f0b9dba46e744ce1c9ffd3bfe73bebc4abcf3e5b0df5dd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bac5429c78c7f4d25c6419ba9683c891

SHA1
fad01662a50e4776b09e8a348b246be26b4617d1

SHA256
6b97b3684e7c66f7fba8db06da7ba34af5d4d8e3a3d412e9b1aa2b0e730bd772

SHA512
c9d1e41844d135012a0b9749ed1be3117beff5333af6f11f23596704d2c67b2754cc69c632d9d3b4c7bca5f5a1923313f2ae7616c51378c1ecd7ea93e96b4655

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6068c12d1d468d42a989103ce4a334b5

SHA1
1e3378a994d43171c1e9922367408e81d16e410d

SHA256
c10f822b9962864ac59570d7e5cbd808698bb4763e816f15db8a8f53cd9c487e

SHA512
786a65ded651ccbc49c62863fee4ff1618596043b5480714627d3a8117ac684a1e0c5686d501d89cf87765e30e8a8f96a7abd2d93bb229a5486ba091bcb216e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6feab0cd74b6281d681c5919cfa634ae

SHA1
d16f31273affa26eee1f239f77c42a1657cbff96

SHA256
7ba7a74fa1bb9ceec2b7baa360d6e6dfe90cc94215dc0b1fb1366c38de6c66d0

SHA512
420d4db0225a4bfc7035419bfd087211c4aebe25f43d2a116d734b1fffa5b2b8d92470eeb0005cfe39ad82e7f58d6d62e6ec4182125ebdbd2be0a2744a180631

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b013b598551d9c5846ee5327ea47aa7

SHA1
9e6c3d385a32e195e6ec69ac73f5c69ea1b79820

SHA256
cd99168aa717cd30256e42b37fadfe461d1c619e2d9a91053d158b4831edf2d0

SHA512
93e29731ea8b86b9a1712ccc06d03a89012ccb5fc9c89c4a14589e4098596c77e4644c397b8af6cd547c86ce37c27b88edeb1e06198ddf8da39c4868fd38e91d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba701fa9d84c8d03c0e5ee463402ac63

SHA1
edc3b117614acc4123c8a037423755fc1b2f85e0

SHA256
98916b98ce650b2ae72e95081934ac25503c1814904166cfa555a78907811ebd

SHA512
69001606eac0c4ffa5ed064efecb2c8d1dc570dae584b8ab2a73748669d44f34fed20c86da243cf7f3e09f592fb55c91e9f70ee8f6b2dcc672a851e64f6cb955

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55f8429b5efe128f4067c8ea9bc5ae5e

SHA1
c137ca7df7e9de51c519dbfed66acf96f4cb7b73

SHA256
1e92fc5c3a5cb8257f9deaea972bd76ea903b3359f42c92031172d3511770be1

SHA512
df4f68f470b0d2fedc6484fc7d7e4edbac67c9ee3b30fab70ea4957be2907d576a620fffe56ec753705dfc78fe9511f46339840dea35ed6836a3f0934ec9af4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d6dabbed8a09594993a22aced71416a

SHA1
6869629d212b70166451d28bb2d364c230ceb887

SHA256
793fc11714534d572bb2999eee4bedb13886cab02d6b4bb7279d03ad1c38ddbc

SHA512
8a3ac070867ff2f04de60571b22a79586a643791c601354d860e4668277ef2e4610e0e7ae30c6fe9c59f203071d0922ec301b8b1426b414f6d9b39d2098c9b42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eaf5234e046f27e15c456ecef7c7415a

SHA1
cef05b1099b2420e14275ffd317a02bd0857661b

SHA256
1e8582480eb58bcfd8c075518382b019cadfe4f32fa5be88e670d623c21ad093

SHA512
13a2225ee24119aabd142209e1ce55b1983984af3a03c62b169ad139fe95e087e4f6f90d22e71efb0be5b358f475713d74c06971dcd3cf44329baeb07cd27462

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1d53583a8300d8307aa53f394b469ce

SHA1
62ea972ebf168cc5ccf9cbf21ccb320f45163c2b

SHA256
7061e9dfa2a6d4a7679454546e0798b9b9e93319bd9ac2de4ae130c259b5922e

SHA512
d35ffcb23b81173b3b510f8afae638bbf575c44a5b5b22e791047280d29d04e779985eeb8d5e7b84fff85fdcf9acecda8e4ea179af3b12de8dc9be0cf92f64e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4eeb92e447f46b7b2c3432572774cf4

SHA1
1a6c788c867a040199aefb2c4f80bfb1460bd221

SHA256
8bc27654fc9bde9d182f262918a6b64a607af93171f2119ef2af4a14ccaf4f6d

SHA512
e1f9cddb08037d742ac94bcca93b611dc80c5d6a2475245c22fd702008742a7639ae4c40b9896e2e31f90645da8f931912d78dc7e8ca33af0c37e2d2d811e1d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a921db4d00ef47c1178ea3b814087fc1

SHA1
470a37fc72a7cd5008cc6206e808caeddca9e1e6

SHA256
a7c3f79fd88f6e9e9511212534fe896a713184cd3288048b1bda7a08d7269818

SHA512
3490d9bd51cecbd6ce0754d209358586a12867cd03432de7222c9b34191f59e27adb4f37fb04cf1a89ff8a38164980c51b5112f92b20f18054f93d7ad5ba166c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edab61ae5770970c32f1223889cb51d5

SHA1
42a71386365162e5241bf23823268fd08a4862cf

SHA256
bc412de9aedb86a83754b2b26f3ffaf5b27d02f74bcb29e988f0130949a10abd

SHA512
e8ecabd384616b47c2ae59affe47ecc3e3c2822bfc3cfda1806784e913ce473e862e2847875162beba7874bf725506aa6bb6ea5d47e612dbe1cd364e40914161

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0c33df6358b06f11a3616b44c446656

SHA1
9646cc46b174e258010346c267da501510dbc313

SHA256
0479d6bfd92a0aaf3e2bf989c63c979febf06ef33c744f12f72a80111090c751

SHA512
1412f93b109841049a8a8768cb49ee544cb088e4ea895a45ad590d259c794c5c6be9d03a22d2c6e60f2b6b492a34ef430584d4cc1052254e414109c16eaa28e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d90fa59072a75942873b304fcc2d41cb

SHA1
630924a94f27940f519f5346d5d94516a0e26c56

SHA256
754deff58c8149d1141f9c1a79f1d45323c885f787f8c730fec311b3a0e3214d

SHA512
c0b3d4756fc8a821bd0e1c942a5d59e5e8d41d1fc79b16657fd1fbf0e4aea3ff0b470aa810c8f5448faa69dd6d405f4d47cab8c55a3f21a6470f16c624837a58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab199B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A7C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit